Kentucky Privacy Laws for Lymphedema Therapy Practices: A Practical Compliance Guide

Overview of Kentucky Consumer Data Protection Act

The Kentucky Consumer Data Protection Act (KCDPA) took effect on January 1, 2026. It creates baseline rules for how qualifying businesses collect, use, and disclose personal data, and it is enforced exclusively by the Kentucky Attorney General. Penalties can reach up to $7,500 per violation after a 30‑day cure period. ([ag.ky.gov](https://www.ag.ky.gov/about/Office-Divisions/ODP/KCDPA/Pages/default.aspx))

Key features you should know

• Privacy Notice Requirements: publish a clear, accessible privacy notice that lists the categories of data you process, purposes, sharing categories, third parties, and how consumers can exercise and appeal their rights. If you sell personal data or engage in targeted advertising, disclose it and provide an opt‑out. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55839))
• Security and data minimization: collect only what is necessary and maintain reasonable administrative, technical, and physical safeguards proportional to the data you hold. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55839))
• Data protection impact assessments (DPIAs): required for targeted ads, sale of personal data, profiling that poses foreseeable risks, processing of sensitive data, or any processing that presents heightened risk (applies to activities created or generated on/after June 1, 2026). ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=56649))

Applicability Criteria for Lymphedema Practices

Start with your HIPAA status. If your lymphedema therapy practice is a HIPAA “covered entity” or a “business associate,” the KCDPA does not apply to you at the entity level. KCDPA also exempts nonprofits, higher‑education institutions, and government entities. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=56648))

Does KCDPA apply to you?

• Threshold test: KCDPA applies if, in a calendar year, you control or process personal data of at least 100,000 Kentucky consumers, or at least 25,000 consumers and derive over 50% of gross revenue from the sale of personal data (defined as exchange for monetary consideration). ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=56648))
• If you are exempt under HIPAA, KCDPA’s duties and consumer rights generally do not attach to your practice. Re‑evaluate if you spin up non‑covered lines of business in separate legal entities (for example, a retail e‑commerce site) that could meet KCDPA thresholds. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=56648))

Handling Sensitive Data in Therapy

Sensitive Data Classification under KCDPA

KCDPA labels certain information as “sensitive data,” including mental or physical health diagnosis, genetic or biometric identifiers used for identification, precise geolocation (within a 1,750‑foot radius), and data collected from a known child under 13. Processing sensitive data requires opt‑in consent when KCDPA applies. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55836))

Operational safeguards that fit therapy workflows

• Consent flows: when KCDPA applies, obtain explicit consent before processing any sensitive data outside your HIPAA‑regulated activities. Keep timestamped records of consent and revocation. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55839))
• Minimize and segregate: limit intake forms to data you truly need for treatment and operations. Isolate marketing or website analytics data from clinical systems and restrict access by role. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55839))
• Protect ePHI: for HIPAA‑covered practices, implement administrative, physical, and technical safeguards (for example, access controls, audit logs, encryption in transit/at rest, and documented risk analysis). ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/index.html?utm_source=openai))

Consumer Rights under KCDPA

When KCDPA applies, Kentucky residents can exercise Data Subject Rights to access, correct, delete, and obtain a portable copy of their personal data; and to opt out of targeted advertising, sale of personal data, and certain profiling. You must respond within 45 days (extendable once by 45 days with notice), provide responses free of charge up to twice per year, and offer an appeal process with a decision due within 60 days. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55838))

HIPAA Requirements for Protected Health Information

Protected Health Information (PHI) is individually identifiable health information held by covered entities and certain business associates. HIPAA’s Privacy Rule governs permitted uses and disclosures; most other uses require the patient’s written authorization. Covered providers must also give patients a Notice of Privacy Practices and ensure “minimum necessary” use/disclosure. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html?pubDate=20250430&utm_source=openai))

• Right of access: you must act on a patient’s request for access to their PHI within 30 calendar days (with limited, documented extensions). ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/how-timely-must-a-covered-entity-be/index.html?utm_source=openai))
• Business Associate Agreements (BAAs): execute BAAs with vendors that handle PHI for you (for example, EHRs, billing, cloud storage). ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html?hl=en&utm_source=openai))
• Security Rule: maintain risk‑based administrative, physical, and technical safeguards to protect ePHI’s confidentiality, integrity, and availability. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/index.html?utm_source=openai))

Medical Record Retention Obligations

Record retention in Kentucky depends on your facility type and payer contracts. Many therapy practices are outpatient providers that also bill Medicaid; pay close attention to the rules that apply to your setting. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/kar/titles/907/001/102/?utm_source=openai))

Kentucky requirements that often affect therapy practices

• Hospitals and hospital outpatient departments: retain medical records for at least six years from discharge; for minors, at least three years after reaching the age of majority—whichever is longer. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/kar/titles/902/020/016/?utm_source=openai))
• Certain outpatient facility types (for example, comprehensive physical rehabilitation hospitals or specified centers): retain for at least five years; for minors, at least three years after majority. Confirm your licensure category. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/Law/KAR/titles/902/020/240/?utm_source=openai))
• Medicaid‑enrolled providers: keep records at least six years from date of service (longer if audits, disputes, or federal rules require it); for minors, at least three years after majority. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/kar/titles/907/001/102/?utm_source=openai))

Build a conservative retention plan

• Adopt the longest applicable period across state facility rules, Medicaid, Medicare, commercial payer contracts, and malpractice considerations, and document your destruction protocols.
• Ensure retention policies cover both paper and electronic records, including imaging, photos, and therapy videos stored in your EHR or secure systems.

Managing Patient Recording Rights and Facility Policies

Know the One-Party Consent Law

Kentucky is a one‑party consent state. A person may record a conversation if at least one party to that conversation consents—meaning a patient can generally record their own therapy session’s audio without informing you. Recording others without any party’s consent is eavesdropping and a crime. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=19948&utm_source=openai))

Design a patient recording policy

• Protect all patients’ privacy: forbid recording of other patients and any images that could reveal their PHI; require staff approval for any staff‑focused recording in treatment areas.
• Address telehealth and interstate calls: if your call or video visit involves a patient in an all‑party‑consent state, align with that state’s rules too.
• Use signage and scripts: post “no unauthorized recording” notices, train staff on how to handle requests, and document any permission granted or denied.
• If recording disrupts care or violates policy, you may pause or end the visit and reschedule under safer conditions; document the incident.

In practice, most Kentucky lymphedema clinics are governed primarily by HIPAA, payer rules, and Kentucky’s medical‑record regulations, while KCDPA affects only non‑exempt operations that meet specific scope thresholds. A concise privacy notice, disciplined data minimization, strong HIPAA safeguards, and a clear patient‑recording policy will keep your therapy practice compliant and patient‑centered. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55839))

FAQs

What personal data does KCDPA protect for therapy practices?

When KCDPA applies, it covers “personal data” linked or reasonably linkable to a Kentucky resident and gives them Data Subject Rights. It also designates “sensitive data” (for example, mental or physical health diagnosis, certain biometrics, child data, precise geolocation) that needs opt‑in consent. However, HIPAA‑covered entities and business associates are exempt from KCDPA. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=55836))

How does HIPAA impact lymphedema therapy privacy compliance?

HIPAA governs Protected Health Information handled by covered providers and their business associates. You must provide a Notice of Privacy Practices, follow permitted‑use rules or obtain authorization, secure ePHI with risk‑based safeguards, maintain BAOs with vendors, and respond to patient access requests within 30 days. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html?pubDate=20250430&utm_source=openai))

What are the patient rights regarding medical data under Kentucky law?

Under HIPAA, patients can access their PHI, request corrections, and obtain copies within set timelines. Under KCDPA (if it applies to a non‑exempt operation), Kentucky consumers can request access, correction, deletion, portability, and opt‑outs for targeted ads, sale, and certain profiling; controllers must respond within 45 days and provide an appeals path. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html?pubDate=20250430&utm_source=openai))

Can patients record their lymphedema therapy sessions without consent?

Yes—Kentucky’s One‑Party Consent Law allows a participant to record their own conversation. Your clinic can still set reasonable policies to prevent recording of other patients or sensitive areas and may require staff approval for recordings during care. ([apps.legislature.ky.gov](https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=19948&utm_source=openai))